CVE-2019-25677 MEDIUM

CVE-2019-25677: WinRAR 5.61 Denial of Service via Malformed Language File

Vendor Win-Rar

Product WinRAR

Weakness CWE-379

Published April 5, 2026

Last update April 6, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Local

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

WinRAR 5.61 contains a denial of service vulnerability that allows local attackers to crash the application by placing a malformed winrar.lng language file in the installation directory. Attackers can trigger the crash by opening an archive and pressing the test button, causing an access violation at memory address 004F1DB8 when the application attempts to read invalid data.

Key dates

02Disclosure timeline

April 5, 2026 CVE published

April 6, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2019-25677 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/379.html

Related vulnerabilities

04Related CVE

CVE-2026-42191 OpenTelemetry.Exporter.OpenTelemetryProtocol: Disk retry default temp path enables local blob injection for OTLP Exporter CVE-2013-1815 Packstack: red hat openstack: packstack: unauthorized system modification via insecure answer file creation CVE-2021-39827 Adobe Digital Editions Installer flaw leads to Arbitrary File System Write CVE-2021-31411 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 CVE-2021-43017 Adobe Creative Cloud DLL Hijacking Local Application Denial of Service